I assume you have this checked and/or you looked at packet info for the bad checksum.
http://wiki.wireshark.org/TCP_Checksum_Verification
Then some issue with those two. Either some alternate syn checksum, firewall deal or vpn deal is all I can guess.
Checksum offloading reports all frames as bad as I recall in wireshark.
Hopefully someone knows for sure.